patching.py

import boto3
import sys
import time
import os
from wait_for_status import wait_for_ssm_command
 
# Read environment variables
instance_id = os.getenv("InstanceID") or sys.argv[1]
region = os.getenv("region") or sys.argv[2]
 
 
 
# Create SSM client
ssm = boto3.client("ssm", region_name=region)

# this allows to patch multiple instances in one Run Command
instance_ids_list = [i.strip() for i in instance_id.split(",") if i.strip()]

# It triggers Run Command via SSM.
response = ssm.send_command(
    DocumentName="AWS-RunPatchBaseline", # this document is used for Linux or Windows servers
    InstanceIds=instance_ids_list,
    Parameters={
        "Operation": ["Install"], # Downloads and installs missing patches
        "RebootOption": ["RebootIfNeeded"] # Automatically reboots the instance only if required
    },
    TimeoutSeconds=9000 # 2.5 hours
)

# Extract the command ID
command_id = response["Command"]["CommandId"]
 
# Wait 3 seconds
time.sleep(3)
 
# Print command ID
print(command_id)
 
# Call the wait for status function
# Waits until the command is Success, Failed, or TimedOut
wait_for_ssm_command(command_id, region)